Who is this research for? General business leaders, technology executives, and data governance professionals responsible for managing digital trust, platform risk, and organizational responses to data breaches.
Executive Summary
This research from Rajiv Sabherwal at the Sam M. Walton College of Business, University of Arkansas (Department of Information Systems) examines how individuals react over time after experiencing a data breach. Using Facebook’s Cambridge Analytica breach as a real-world setting, the study compares confirmed breach victims with non-victims, tracking changes in trust, attitudes, and behavioral intentions across multiple time periods.
The findings suggest that actual breach victims exhibit stronger negative reactions than non-victims immediately after learning their data were compromised, including declines in trust and willingness to continue using the platform, as well as heightened feelings of violation and feeling as if a “psychological contract” with Facebook had been breached. However, these differences diminish over time, with attitudes converging back to those of non-victims within several months. Importantly, follow-up analyses indicate that this recovery does not necessarily reflect restored confidence or effectiveremediation. Instead, users’ continued engagement - often driven by high switching costs, platform dependence, and inertia - appears to play a central role in shaping longer-term attitudes. Together, the results suggest that the absence of sustained user backlash should be interpreted as a signal that consumer responses alone may fail to adequately discipline poor data governance practices.
Action Items for Industry
- Expect intense short-term scrutiny—but don’t mistake fading reactions for restored trust: Initial negative responses from breach victims are real and meaningful, even if they are not permanently visible in usage or attitudes.
- Recognize that user retention may mask underlying governance risk: Continued platform use after a data breach may reflect high switching costs rather than renewed confidence in the organization.
- Treat data breaches as a governance and accountability issue, not just a reputational event: The findings show the absence of effect of anticipated customer punishment, implying that long-term risk management instead depends on internal controls and oversight.
- Design crisis responses for credibility, not just containment: Transparent communication and demonstrable improvements to data security practices may matter more than short-term remediation efforts alone.
- Reassess assumptions about market discipline in digital platforms: When users are locked in, leaders bear greater responsibility for proactive data protection and ethical data stewardship.
Quote from the Researcher
"Based on extensive analyses of the Facebook’s Cambridge Analytica scandal, we find that victims of data breaches initially experience greater negative reactions than non-victims — but not for long. Trust drops and feelings of violation spike, yet within six months, those effects largely disappear. This lack of long-term consumer response questions the role of post-breach compensation and suggests that regulation may be needed to better protect data.”
– Rajiv Sabherwal
Co-Authors & Affiliations
- Frederic Schlackl — HEC Montréal
- Florian Pethig — Tilburg University, Tilburg School of Economics and Management
- Hartmut Höhle — University of Mannheim, Business School
Link to the Original Research
Accepted for publication in Information Systems Research, available here.
📩 Interested in learning more? If you’d like additional information about this research or to connect directly with the researchers, please email us at research@walton.uark.edu.
